server.internal.auth

fn decode_jwt(token string) !Jwt

fn new_oidc_verifier() &OidcVerifier

fn parse_login_chain(auth_info_json string, require_xbox bool, mut verifier Verifier) !Identity

parse_login_chain verifies the JWT signature chain and returns the client identity. A self-signed (offline mode) chain has valid signatures that prove nothing about who the player really is. xbox_authenticated is only true when the chain roots in Mojang's public key, or the token is a genuine, current OpenID token issued by Microsoft for this audience (see parse_identity_token). Treat display_name and xuid as unverified unless xbox_authenticated is true.

fn verify_jwt(token string, public_key_b64 string) !bool

interface Verifier {
mut:
	verify(token string) !map[string]json2.Any
}

Verifier validates a single-token OpenID login. OidcVerifier is the default implementation; embedders may provide a custom verifier for testing or custom token-validation policies.

struct Identity {
pub:
	xuid               string
	uuid               string
	display_name       string
	xbox_authenticated bool
	client_public_key  string
}

struct Jwt {
pub:
	header  map[string]json2.Any
	payload map[string]json2.Any
}

struct OidcVerifier {
mut:
	mutex          &sync.Mutex = sync.new_mutex()
	issuer         string
	jwks_uri       string
	discovered     bool
	keys           []JwksKey
	last_key_fetch i64
}

OidcVerifier discovers Microsoft's OpenID configuration and checks login tokens against its published signing keys. Build one and reuse it for the whole process (Hub owns one). It fetches nothing until the first real login, so server startup never depends on the network being up, and discovery and keys are cached afterward so later logins are free unless a key rotation forces a refresh.

fn (mut v OidcVerifier) verify(token string) !map[string]json2.Any

verify checks token's signature against the discovered JWKS and validates iss, aud, exp and nbf, returning the payload only for a genuine, current Microsoft token issued for this audience. Any failure (unknown kid, bad signature, wrong issuer or audience, expired token) is a plain error. Callers treat every error the same as not authenticated.